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PROPOSED AMENDMENT TO CLAIM 39 



39. 



An apparatus configured to monitor and audit activity in a legacy system, 



the apparatus comprising: 



a) 



an analyzer being configured to analyze intercepted packets, 



wherein said packets are conveyed between terminals and hosts in said legacy 
system, wherein said hosts in said legacy system use at least one incremental 
legacy protocol for conveying fields associated with a screen to a terminal, and 
wherein said analyzer is further configured to generate analyzed data based on 
information associated with at least some of said packets, the analyzed data 
being indicative of sessions in said legacy system and being indicative of an 
incremental screen protocol used in each of said sessions; 

b) a mirror manager being responsive to said s analyzed data for 
generating data representative of one or more mirror sessions, said data 
representative of one or more mirror sessions comprising an identification of at 
least one screen and at least one field associated with said at least one screen, 
while each mirror session corresponding to one of said sessions; 

c) a data storage unit comprising a computer readable medium 
accessible thereto for storing said data representative of one or more mirror 
sessions; and 

d) an audit event analyzer being responsive to said data 
representative of one or more mirror sessions, stored in said data storage unit, 
said audit event analyzer being configured to generate an outbound audit event 
comprising fields associated with a screen to be displayed on a terminal in said 
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legacy system, said fields comprising at least one input field for allowing a user 
to insert input information therein and inbound audit events comprising input 
information inserted by a user of a terminal into an input field associated with a 
screen and a screen location indicating where said input information was 
inserted in said screen, said audit event analyzer further being configured to 
associate an inbound audit event with an outbound audit event to identify data 
representative of input information inserted by a user in an inbound audit event, 
and to form data representative of a united audit event by combining data 
representative of said outbound audit event with data representative of input 
information in the associated inbound audit event. 
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